In a computer system which is constantly required to operate in a stable manner, such as a mission-critical system of a data center or company, reliability is increased by providing redundant servers. By operating redundant servers in addition to minimum necessary servers, even if some of the servers fail, the computer system can provide services stably using the remaining servers.
Regarding conventional server redundancy techniques, for example, Patent Document 1 (Japanese Patent Laid-Open No. 2002-55840A) describes dual-redundancy, N+M configuration, and N+1 configuration. The dual-redundancy involves providing a redundant server (physical server) for every server. The N+M configuration involves providing M redundant physical servers for N servers. A configuration in which M=1, in particular, is referred to as an N+1 configuration.
Even if a physical server fails, the redundancy technique described in Patent Document 1 can continue operating a computer system by cutting off the failed physical server from the computer system. The act of reconstructing a computer system using the remaining physical servers excluding the failed physical server is known as degradation and the configuration resulting from the degradation is called a graceful degradation.
On the other hand, recent mission-critical systems of data centers and companies have been adopting a form in which multiple virtual servers are constructed on a physical server using virtual machine technology.
For example, Non-Patent Document 1 (B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, I. Pratt, A. Warfield, P. Barham and R. Neugebauer, Xen and the Art of Virtualization, 19th ACM Symposium on Operating Systems Principles (SOSP19), 2003.) discloses a technique for using computer resources (a CPU, memory device, and the like) of a physical server as multiple virtual servers implemented by required processing programs.
Non-Patent Document 1 proposes to dynamically change the quantity of computer resources allocated to the virtual servers according to services to be provided. The use of virtual machine technology makes it possible to provide a redundant server for each service-providing subsystem (application program: hereinafter simply referred to as an application) by simply adding virtual servers without introducing new physical servers, and thereby make the computer system redundant at a lower cost.
Generally the total quantity of computer resources available on a physical server is limited. Therefore, with a redundancy technique which uses virtual machine technology, if the quantity of computer resources allocated to virtual servers standing by as redundant virtual servers is increased, there may be some virtual servers which do not meet the quantity of computer resources needed to provide a service because of reduced computer resources.
In particular, with a computer system equipped with multiple subsystems (applications), since a minimum number of virtual servers required for each subsystem (application) is determined based on availability requirements of the subsystem (application), it is necessary to ensure that migration to a graceful degradation will not result in a subsystem (application) which would violate the availability requirements.
However, the redundancy technique described in Non-Patent Document 1 does not take into consideration the effects of changes in the quantity of computer resources allocated to an arbitrary virtual server on other virtual servers, and thus cannot be applied directly to the redundancy technique which uses the virtual machine technology. That is, a technique for migration to a graceful degradation is needed in order to meet the availability requirements of each subsystem (application) running on the computer system.
A related redundancy technique is not provided with a technique for migrating to a graceful degradation by changing the amount of computer resources allocated to virtual servers, and thus cannot determine a graceful degradation according to a failed physical server.